IN THE CLAIMS: 

Claims 1, 12, 14-22 and 24-29 are amended herein. Claims 10 and 23 are cancelled. 
All pending claims and their present status are produced below. 

1 . (Currently Amended) A method for calculating application verb response times, 
comprising: 

(a) receiving packet data; 

(b) aggregating the packet data into flows; 

(e) identifying application verbs and information relating to them associated with the 
flows; and 

(d) determining whether the application verbs are valid; 

(e) updating a state machine if it is determined that the application verbs are valid; 
and 

(f> storing the information relating to the application verbs; 

(g) wherein the information relating to the application verbs is capable of being used 
to calculate response times associated therewith. 

2. (Original) The method as recited in claim 1 , and further comprising determining 
whether the packet data is associated with a new flow. 

3. (Original) The method as recited in claim 2, wherein if the packet data is determined 
to be associated with a new flow, further comprising creating a flow, creating a data 
structure, and inserting the data structure into the flow. 

4. (Original) The method as recited in claim 3, wherein the creation of the data structure 
includes identifying a protocol identifier associated with the flow, and determining a 
number of known application verbs associated with the protocol identifier. 

5. (Original) The method as recited in claim 4, wherein the creation of the data structure 
further includes allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier. 
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6. (Original) The method as recited in claim 4, wherein the number of application verbs 
associated with the protocol identifier is determined utilizing a map. 

7. (Original) The method as recited in claim 6, wherein the map maps to a RMON tree. 

8. (Original) The method as recited in claim 1, and further comprising inserting a data 
structure into the flows. 

9. (Original) The method as recited in claim 8, wherein the aggregation includes 
populating and updating the data structure with the information. 

10. (Canceled) 

1 1 . (Original) The method as recited in claim 9, wherein the aggregation further includes 
determining whether a response is complete, and calculating a response time if it is 
determined that the response is complete. 

12. (Currently Amended) The method as recited in claim [[10]] H, wherein the 
aggregation further includes determining whether the state machine is in a valid state, 
and utilizing the state machine as being representative of the response time if it is 
determined that the state machine is in a valid state. 

13. (Original) The method as recited in claim 1, wherein the information relating to the 
application verbs incapable of being used to calculate response times associated 
therewith in real-time. 

14. (Currently Amended) A computer-readable medium having a computer program 
product for calculating application verb response times, 

comprising: 

(a) computer code for receiving packet data; 

(b) computer code for aggregating the packet data into flows; 
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(e) computer code for identifying information relating to application verbs associated 
with the flows; and 

(d) computer code for determining whether the application verbs are valid; 

(e) updating a state machine if it is determined that the application verbs are valid; 
and 

(£) computer code for storing the information relating to the application verbs; 
(g) wherein the information relating to the application verbs is capable of being used 
to calculate response times associated therewith. 

15. (Currently Amended) The computer-readable medium of c omput e r program product 
as recit e d in claim 14, wherein the computer program product and further comprising 
comprises computer code for determining whether the packet data is associated with a 
new flow. 

1 6. (Currently Amended) The computer-readable medium of comput e r program product 
as recit e d in claim 15, wherein if the packet data is determined to be associated with a 
new flow, further comprising computer code for creating a flow, creating a data 
structure, and inserting the data structure into the flow. 

1 7. (Currently Amended) The computer-readable medium of comput e r program product 
as recited in claim 16, wherein the creation of the data structure includes identifying a 
protocol identifier associated with the flow, and determining a number of application 
verbs associated with the protocol identifier. 

18. (Currently Amended) The computer-readable medium of comput e r program product 
as r e cited in claim 17, wherein the creation of the data structure further includes 
allocating memory for the data structure based on the number of known application 
verbs associated with the protocol identifier. 
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1 9. (Currently Amended) The computer-readable medium of comput e r program product 
as recit e d in claim 17, wherein the number of known application verbs associated 
with the protocol identifier is determined utilizing a map. 

20. (Currently Amended) The computer-readable medium of comput e r program product 
as r e cit e d in claim 1 9, wherein the map maps to a RMON tree. 

2 1 . (Currently Amended) The computer-readable medium of comput e r program product 
as r e cit e d in claim 14, wherein the computer program product and further comprising 
comprises computer code for inserting a data structure into the flows. 

22. (Currently Amended) The computer-readable medium of computer program product 
as recit e d in claim 2 1 , wherein the aggregation includes populating and updating the 
data structure with the information. 

23. (Canceled) 

24. (Currently Amended) The computer-readable medium of comput e r program product 
as r e cit e d in claim 22, wherein the aggregation further includes determining whether 
a response is complete, and calculating a response time if it is determined that the 
response is complete. 

25 . (Currently Amended) The computer-readable medium of comput e r program product as 
r e cit e d in claim [[23]] 22, wherein the aggregation further includes determining whether 
the state machine is in a valid state, and utilizing the state machine as being 
representative of the response time if it is determined that the state machine is in a 
valid state. 

26. (Currently Amended) The computer-readable medium of comput e r program product 
as recit e d in claim 14, wherein the information relating to the application verbs is 
capable of being used to calculate response times associated therewith in real-time. 
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27. (Currently Amended) A system for calculating application verb response times, 
comprising: 

(a) means for receiving packet data; 

(b) means for aggregating the packet data into flows; 

(e) means for identifying information relating to application verbs associated with the 
flows; and 

(d) means for determining whether the application verbs are valid; 

(e) means for updating a state machine if it is determined that the application verbs 
are valid; and 

(f) means for storing the information relating to the application verbs; 

(g) wherein the information relating to the application verbs is capable of being used 
to calculate response times associated therewith. 

28. (Currently Amended) A computer-readable medium having computer readable 
instructions data structur e for calculating application verb response times, the 
computer readable instructions configured to implement a data structure, comprising: 

(a) a plurality of application verb objects for identifying information relating to 
application verbs associated with a flow; and 

(b) a state machine object; 

(e) wherein the application verb objects and the state machine object are capable of 
being used to validate response times. 

29. (Currently Amended) A method for calculating response times, comprising: 

(a) receiving packet data; 

(b) aggregating the packet data into a flow; 

(e) identifying information relating to application verbs associated with the flow; 

(d) determining whether the application verbs are valid; 

(e) updating a state machine if it is determined that the application verbs are valid; 

(f) storing the information relating to the application verbs in a data structure; 

(g) inserting the data structure in the flow; and 

(h) mapping the data structure to a remote monitoring (RMON) tree. 
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30. (Original) A method for calculating response times, comprising: 

(a) receiving packet data; 

(b) determining whether the packet data is associated with a new flow; 

(c) if the packet data is determined to be associated with a new flow: 

(i) creating a flow, 

(ii) providing a notification of the flow, 

(iii) creating a data structure in response to the notification, the creation of the data 
structure including: 

1 ) identifying a protocol identifier associated with the flow, 

2) caching the protocol identifier, 

3) determining a number of known application verbs associated with the 
protocol identifier, and 

4) allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier, and 

(iv) inserting the data structure into the flow; and 

(d) aggregating the packet data by: 

(v) identifying application verbs in the flow, 

(vi) determining whether the application verbs are valid, 

(vii) updating a state machine if it is determined that the application verbs are valid, 

(viii) determining whether a response associated with the flow is complete, 

(ix) calculating a response time if it is determined that the response is complete, 

(x) determining whether the state machine is in a valid state, and 

(xi) utilizing the data structure as being representative of the response time if it is 
determined that the state machine is in a valid state. 
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